Brad Mace's questions

I have TeamCity agents installed on a CentOS 7.3 server, and am trying to use the "SSH agent" build feature for a script that uses scp. However, it always fails due to a TimeoutException:

[12:39:32]  [Step 1/4] Failed to load SSH key 'Staging & Deployment Key_'
[12:39:31]  [Step 1/4] 'ssh-add /home/agent/002/temp/buildTmp/teamcity979243148311152591sshKey' command failed
exception: jetbrains.buildServer.ProcessTimeoutException: Timeout exception: the process did not produce output longer than 5 seconds; Process: ssh-add /home/agent/002/temp/buildTmp/teamcity979243148311152591sshKey
exit code: -1
[12:39:31]  [Step 1/4] Starting: /home/agent/002/temp/agentTmp/custom_script5200058812461913901
[12:39:31]  [Step 1/4] in directory: /home/agent/002/work/7facf668c0fd7484
[12:39:32]  [Step 1/4] Process exited with code 0
[12:39:32]  [Step 1/4] Step Create local directories (Command Line) failed

Can anyone tell me whether this is an SSH issue, and agent setup issue, or a build configuration issue? TeamCity docs claim this should work out of the box, so they're not much help on troubleshooting this.

I'm trying to run an OpenLDAP server on CentOS 6.4 with selinux enabled, but slapd is dieing as soon as it's started via /etc/init.d/slapd start. (init script reports OK; everything works fine after setenforce 0.

found these messages in /var/log/audit/audit.log:

type=AVC msg=audit(1372888328.397:3262): avc:  denied  { write } for  pid=1492 comm="slapd" name="slapd.log" dev=dm-0 ino=4348 scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file
type=SYSCALL msg=audit(1372888328.397:3262): arch=40000003 syscall=5 success=no exit=-13 a0=1bd1018 a1=241 a2=1b6 a3=7ea191 items=0 ppid=1491 pid=1492 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=337 comm="slapd" exe="/usr/sbin/slapd" subj=unconfined_u:system_r:slapd_t:s0 key=(null)
type=AVC msg=audit(1372888328.408:3263): avc:  denied  { sys_nice } for  pid=1492 comm="slapd" capability=23  scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:system_r:slapd_t:s0 tclass=capability
type=SYSCALL msg=audit(1372888328.408:3263): arch=40000003 syscall=156 success=yes exit=0 a0=5d4 a1=0 a2=bfe64968 a3=b787a6c0 items=0 ppid=1491 pid=1492 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=337 comm="slapd" exe="/usr/sbin/slapd" subj=unconfined_u:system_r:slapd_t:s0 key=(null)
type=AVC msg=audit(1372888328.424:3264): avc:  denied  { read } for  pid=1493 comm="slapd" name="log.0000000001" dev=dm-0 ino=263969 scontext=unconfined_u:system_r:slapd_t:s0 tcontext=unconfined_u:object_r:var_log_t:s0 tclass=file
type=SYSCALL msg=audit(1372888328.424:3264): arch=40000003 syscall=5 success=no exit=-13 a0=1c78270 a1=8000 a2=0 a3=0 items=0 ppid=1 pid=1493 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=337 comm="slapd" exe="/usr/sbin/slapd" subj=unconfined_u:system_r:slapd_t:s0 key=(null)

However this leaves me with no idea how to fix it. How do I tell selinux to allow the LDAP daemon to run?

I tried

restorecon -v -F -R /etc/openldap
restorecon -v -F -R /var/lib/ldap

but this didn't work (and in fact it seems to have broken my ability to start slapd even with selinux disabled). Got a lot of messages like

restorecon reset /etc/openldap/cacerts context unconfined_u:object_r:etc_t:s0->system_u:object_r:etc_t:s0

If I just run slapd with no arguments (as root) it starts and works fine. When I try to start it using /etc/init.d/slapd start however, it dies immediately.

I see from looking at the init script that there's a configuration file at /etc/sysconfig/ldap, but I haven't been able to find a working combination of settings. Does anybody know what I need to do?

I went back to the default init script and tried running with debugging, but I didn't see anything helpful. Main details were:

daemon --pidfile=/var/run/slapd.pid --check=slapd /usr/sbin/slapd -h '" ldap:///"' -u ldap
/bin/bash -c 'ulimit -S -c 0 >/dev/null 2>&1 ; /usr/sbin/slapd -h " ldap:///" -u ldap'`.

We currently have a single OpenLDAP server using the cn=config backend. We'd like to add a second OpenLDAP server and configure them for multimaster replication. What do we need to do to

1. enable replication on the existing server and
2. initialize the new server with the existing data

So far what I've done (following this guide) is:

Syncing configuration

dn: cn=config
changetype: modify
replace: olcServerID
olcServerID: 1 ldap://foo.example.com
olcServerID: 2 ldap://bar.example.com
-
replace: olcSaslSecProps
olcSaslSecProps: noanonymous

dn: cn=module,cn=config
changetype: modify
olcModuleLoad: syncprov

dn: olcDatabase=config,cn=config
changetype: modify
olcRootDN: cn=admin,cn=config
olcRootPW: abc123
add: olcSyncRepl
olcSyncRepl: rid=001 provider=ldap://foo.example.com bindmethod=simple
  binddn="cn=admin,cn=config" credentials=abc123 searchbase="cn=config" 
  type=refreshAndPersist retry="5 5 300 5" timeout=3
olcSyncRepl: rid=002 provider=ldap://bar.example.com bindmethod=simple 
  binddn="cn=admin,cn=config" credentials=abc123 searchbase="cn=config" 
  type=refreshAndPersist retry="5 5 300 5" timeout=3
-
add: olcMirrorMode
olcMirrorMode: TRUE

dn: olcOverlay=syncprov, olcDatabase=config, cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov

This got configuration syncing working on both directions.

Syncing data

dn: olcDatabase=bdb,cn=config
changetype: modify
add: olcMirrorMode
olcMirrorMode: TRUE
-
add: olcSyncrepl
olcSyncrepl: rid=001 provider=ldap://foo.example.com searchbase=dc=example,dc=com binddn="uid=ldapsync,ou=Special Accounts,dc=example,dc=com" credentials=xyz123
olcSyncrepl: rid=002 provider=ldap://bar.example.com searchbase=dc=example,dc=com binddn="uid=ldapsync,ou=Special Accounts,dc=example,dc=com" credentials=xyz123

dn: olcOverlay=syncprov, olcDatabase=bdb, cn=config
changetype: add
objectClass: olcOverlayConfig
objectClass: olcSyncProvConfig
olcOverlay: syncprov

I verified that these changes were synced to the second server, and that the ldapsync user can authenticate and can see all the data it needs to. However, the bdb data doesn't seem to be syncing in either direction. What am I missing?

I just set up an OpenLDAP server (v2.4.23) and loaded some data. I can browse and edit via Apache Directory Studio, but not deletions all fail.

For example, I tried to delete a list of DNs from a file:

ldapdelete -f rmroles.txt -W -D "cn=admin,cn=config"

but it dies with the message:

ldap_delete: Server is unwilling to perform (53)
        additional info: shadow context; no update referral

Most of the info I've found suggests that this is related to replication, but I haven't set up replication on this server yet. olcReadOnly is FALSE, and I've set olcAccess to to * by * manage.

Any other ideas what could be wrong?

I'm trying to redirect from an old hostname to the new one. So far I've got

RewriteEngine On
RewriteCond %{HTTP_HOST} ^foo$ [NC,OR]
RewriteCond %{HTTP_HOST} ^foo.company.com$ [NC]
RewriteRule ^(.*) http://bar.company.com/$1 [R=301]

but when I go to foo.company.com/dir/page.html I don't get redirected. What am I doing wrong?

We have two linux samba servers authenticating against LDAP that have been working fine for some time. Recently I added a new user to LDAP. He can log in fine to one server, but the other reports an "invalid SID" id (passdb/passdb.c:lookup_global_sam_name(596)).

His SID follows the same pattern as everyone elses, and it works on the other server. What could be going on here?

• working server is Fedora 8, Samba Version 3.0.33-0.fc8
• problem server is CentOS 5.3, Version 3.0.33-3.7.el5

I have an old SUSE 8.1 server which just recently started acting crazy.

If I start a program once:

/usr/local/jdk1.6.0_21/bin/java -cp example-ser-0.8.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/Translator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=logback-test.xml example.ser.Scanner abc12345

There will be 10 instances running (same user, same arguments) as shown by ps ax -l | grep Scanner:

  F S   UID   PID  PPID  C PRI  NI ADDR SZ WCHAN  TTY        TIME CMD
000 S   502 20228 20227  0  75   0 - 98222 rt_sig pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20229 20228  0  75   0 - 98222 schedu pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20230 20229  0  75   0 - 98222 schedu pts/11     0:14 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20231 20229  0  75   0 - 98222 schedu pts/11     0:01 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20232 20229  0  76   0 - 98222 rt_sig pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20233 20229  0  76   0 - 98222 rt_sig pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20234 20229  0  80   0 - 98222 rt_sig pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20235 20229  0  75   0 - 98222 rt_sig pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20236 20229  0  80   0 - 98222 rt_sig pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
002 S   502 20237 20229  0  75   0 - 98222 schedu pts/11     0:00 /usr/local/jdk1.6.0_21/bin/java -cp /usr/local/lib/java/example-ser-0.7.jar:/usr/local/lib/java/slf4j-api-1.6.1.jar:/usr/local/lib/java/logback-core-0.9.24.jar:/usr/local/lib/java/logback-classic-0.9.24.jar:/usr/local/lib/java/jcl-over-slf4j-1.6.1.jar:/usr/local/lib/java/commons-cli-1.2.jar:/usr/local/lib/java/commons-lang-2.5.jar:/usr/local/lib/java/mysql-connector-java-5.1.13-bin.jar:/usr/local/lib/java/xBaseJ-20091203.jar:/usr/local/lib/java/CampaignRulesTranslator-0.7.0.jar:/usr/local/lib/java/antlr-3.2.jar:/usr/local/lib/java/joda-time-1.6.jar -Dlogback.configurationFile=/usr/local/lib/java/logback.xml example.ser.Scanner abc12345
000 S     0 25155 19094  0  80   0 -   406 pipe_w pts/2      0:00 grep Scanner

If I ^C the terminal where I started the program, all 10 disappear. This program doesn't do any forking or create any extra threads. I also tried several older versions of this program going back years before this problem and they're all experiencing this now as well. What could be going on here?

I have privileges floating around in the mysql.* tables pertaining to users, databases and tables which no longer exist. Is there a simple way to find and remove these orphaned entries?

I have a CentOS 6 server that needs rsh access to one of our old legacy servers which does not support ssh.

RSH connects to port 514 on the remote servers, which then creates another connection back to the client on a port between 512-1023. My current firewall skill level is "port open/port closed" and opening up all of them wouldn't leave much of a firewall. What's the most restrictive way to allow outgoing RSH connections?

I have an LDAP user with this schema:

dn: uid=portal,ou=Special Accounts,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
sn: portal
cn: portal
uid: portal

Can anyone tell me why this would work:

ldapwhoami -h yorktown -U portal

but this:

ldapwhoami -h yorktown -D "uid=portal,ou=Special Accounts,dc=example,dc=com"

results in

ldap_sasl_interactive_bind_s: Invalid credentials (49)
        additional info: SASL(-13): user not found: no secret in database

I'm having some trouble doing updates with proxied authorization. I'm using UnboundID's LDAP SDK to connect to OpenLDAP, and sending a ProxiedAuthorizationV2RequestControl for dn: uid=me,dc=People,dc=example,dc=com with the update. I've tested and verified that the target user has permission to perform the operation, but I get

insufficient access rights

when I try to do it via proxy auth.

I've configured olcAuthzPolicy=both in cn=config and authzTo={0}ldap:///dc=people,dc=example,dc=com??subordinate?(objectClass=inetOrgPerson) on the original user. The authzTo seems to be working; when I change it I get

not authorized to assume identity

when I try the update (also for searches).

I've got this ldapwhoami -U portal -Y DIGEST-MD5 -X u:mace -H ldap://yorktown -Z working now without saslauthd. I just needed to store the proxy user (portal)'s password as plain text. But I'm still getting 'insufficient access rights' when I try to update anything.

Proxy user

dn: uid=portal,ou=Special Accounts,dc=example,dc=com
objectClass: inetOrgPerson
cn: portal
sn: portal
uid: portal
userPassword: test
authzTo: {0}ldap:///dc=People,dc=example,dc=com??sub?(objectClass=inetOrgPerson)

Effective user:

dn: employeeNumber=1400,dc=People,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: posixAccount
objectClass: sambaSamAccount
objectClass: shadowAccount
uid: mace
...

Here's the log from the update attempt, trying to add employeeNumber=1385 as a member of cn=Data Management. It seems to be looking through the nested groups correctly, but it seems like it ought to do indicate a match once it gets to employeeNumber=1400 in cn=administrators.

op tag 0x66, time 1299022001
conn=31595 op=2 do_modify
conn=31595 op=2 do_modify: dn (cn=Data Management,dc=Roles,dc=example,dc=com)
>>> dnPrettyNormal: <cn=Data Management,dc=Roles,dc=example,dc=com>
<<< dnPrettyNormal: <cn=Data Management,dc=Roles,dc=example,dc=com>, <cn=data management,dc=roles,dc=example,dc=com>
conn=31595 op=2 modifications:
  replace: member
          multiple values
conn=31595 op=2 MOD dn="cn=Data Management,dc=Roles,dc=example,dc=com"
conn=31595 op=2 MOD attr=member
>>> dnPretty: <employeeNumber=1020,dc=People,dc=example,dc=com>
<<< dnPretty: <employeeNumber=1020,dc=People,dc=example,dc=com>
>>> dnPretty: <employeeNumber=1385,dc=People,dc=example,dc=com>
<<< dnPretty: <employeeNumber=1385,dc=People,dc=example,dc=com>
>>> dnNormalize: <employeeNumber=1020,dc=People,dc=example,dc=com>
<<< dnNormalize: <employeeNumber=1020,dc=people,dc=example,dc=com>
>>> dnNormalize: <employeeNumber=1385,dc=People,dc=example,dc=com>
<<< dnNormalize: <employeeNumber=1385,dc=people,dc=example,dc=com>
dnMatch -1        "employeeNumber=1020,dc=people,dc=example,dc=com"     "employeeNumber=1385,dc=people,dc=example,dc=com"
bdb_dn2entry("cn=data management,dc=roles,dc=example,dc=com")
==> unique_modify <cn=Data Management,dc=Roles,dc=example,dc=com>
bdb_modify: cn=Data Management,dc=Roles,dc=example,dc=com
bdb_dn2entry("cn=data management,dc=roles,dc=example,dc=com")
bdb_modify_internal: 0x00000043: cn=Data Management,dc=Roles,dc=example,dc=com
>>> dnNormalize: <cn=Administrators,ou=LDAP,dc=Applications,dc=example,dc=com>
<<< dnNormalize: <cn=administrators,ou=ldap,dc=applications,dc=example,dc=com>
=> bdb_entry_get: ndn: "cn=administrators,ou=ldap,dc=applications,dc=example,dc=com"
=> bdb_entry_get: oc: "(null)", at: "member"
bdb_dn2entry("cn=administrators,ou=ldap,dc=applications,dc=example,dc=com")
bdb_entry_get: rc=0
>>> dnNormalize: <cn=system administrators,dc=roles,dc=example,dc=com>
<<< dnNormalize: <cn=system administrators,dc=roles,dc=example,dc=com>
=> bdb_entry_get: ndn: "cn=system administrators,dc=roles,dc=example,dc=com"
=> bdb_entry_get: oc: "(null)", at: "member"
bdb_dn2entry("cn=system administrators,dc=roles,dc=example,dc=com")
bdb_entry_get: rc=0
>>> dnNormalize: <employeeNumber=1306,dc=people,dc=example,dc=com>
<<< dnNormalize: <employeeNumber=1306,dc=people,dc=example,dc=com>
=> bdb_entry_get: ndn: "employeeNumber=1306,dc=people,dc=example,dc=com"
=> bdb_entry_get: oc: "(null)", at: "member"
bdb_dn2entry("employeeNumber=1306,dc=people,dc=example,dc=com")
bdb_entry_get: rc=16
>>> dnNormalize: <employeeNumber=1329,dc=people,dc=example,dc=com>
<<< dnNormalize: <employeeNumber=1329,dc=people,dc=example,dc=com>
=> bdb_entry_get: ndn: "employeeNumber=1329,dc=people,dc=example,dc=com"
=> bdb_entry_get: oc: "(null)", at: "member"
bdb_dn2entry("employeeNumber=1329,dc=people,dc=example,dc=com")
bdb_entry_get: rc=16
>>> dnNormalize: <employeeNumber=1401,dc=people,dc=example,dc=com>
<<< dnNormalize: <employeeNumber=1401,dc=people,dc=example,dc=com>
=> bdb_entry_get: ndn: "employeeNumber=1401,dc=people,dc=example,dc=com"
=> bdb_entry_get: oc: "(null)", at: "member"
bdb_dn2entry("employeeNumber=1401,dc=people,dc=example,dc=com")
bdb_entry_get: rc=16
>>> dnNormalize: <employeeNumber=1400,dc=people,dc=example,dc=com>
<<< dnNormalize: <employeeNumber=1400,dc=people,dc=example,dc=com>
=> bdb_entry_get: ndn: "employeeNumber=1400,dc=people,dc=example,dc=com"
=> bdb_entry_get: oc: "(null)", at: "member"
bdb_dn2entry("employeeNumber=1400,dc=people,dc=example,dc=com")
bdb_entry_get: rc=16
bdb_modify: modify failed (50)
send_ldap_result: conn=31595 op=2 p=3
send_ldap_result: err=50 matched="" text=""
send_ldap_response: msgid=3 tag=103 err=50
conn=31595 op=2 RESULT tag=103 err=50 text=

I'm trying to grant certain accounts auth access to their authzTo attribute in order to allow proxied authorization.

I tried adding this ldif:

dn: olcDatabase={-1}frontend,cn=config
changetype: modify
add: olcAccess
olcAccess: {1}to authzTo by dn.children="ou=Special Accounts,dc=example,dc=com" auth
-

using the command ldapadd -f perm.ldif -D "cn=admin,cn=config" -W

but got this error:

modifying entry "olcDatabase={-1}frontend,cn=config"
ldap_modify: Other (e.g., implementation specific) error (80)
    additional info: <olcAccess> handler exited with 1

using verbose output and turning up the debug level haven't given me any more clues. Can anyone see what I'm doing wrong?

Is there any way to use one of LDAP's DN-based groups for linux groups instead of using the uid-based posixGroup objectclass?

More broadly, is there any way I can avoid having one set of groups for supporting linux accounts and a parallel set of groups that's used by everything else?

There doesn't appear to be a standard date syntax. How do people handle entering dates into ldap so that they are comparable and invalid data can't be entered? I'm hoping to enforce a fairly standard format such as YYYY-mm-dd. Other people have to have done this before but I can't seem to find anything. Anyone have suggestions or links?

The features page indicates they're expecting to support multi-master replication "soon". Does it have any basic master-slave replication yet or does it currently not support any form of replication?

Somehow I've broken by Opsview configuration, and it gives me a completely unhelpful error: critical 2010-10-12 12:09:57 Cannot reload:. It looks like there should be more info, but there's not.

I tried undoing the change I made, and then I tried restoring the previous backup, tried restarting opsview but it always says the same thing.

I've checked

• /usr/local/nagios/var/nagios.log
• /var/log/messages
• /var/log/secure
• /var/log/opsview/opsview-web.log
• /var/log/opsview/opsviewd.log

and haven't been able to find any indication of what the problem is. Does anyone know where else I could look or have an idea what the problem could be?

I'm trying to set up opsview (Nagios) on a CentOS 5 server running perl 5.8.9

When I try to start it, it can't find RRDs.pm. Turns out, neither can I. It's not on CPAN and I've been unable to determine what package would provide it. yum provides "*/RRDs.pm" doesn't return any results.

Edit: so we've established that it should come with the perl-rrdtool package, but unfortunately hasn't. Where do I go from here?